EXPOSURES › CVE-2026-73242
CVE-2026-73242
CRITICALCVE-2026-73242 in FreeRDP allows remote code execution via out-of-bounds reads/writes during Kerberos decryption in FreeRDP versions prior to 3.30.0.
FreeRDP's kerberos_DecryptMessage function fails to bound peer-controlled data, enabling remote code execution through out-of-bounds memory operations during CredSSP/NLA Kerberos decryption. DIB organizations must patch FreeRDP to version 3.30.0 or higher immediately, as this flaw is actively exploitable and aligns with FreeRDP's history of severe memory corruption and RCE vulnerabilities in its graphics and bitmap decoding components.
Shame score — A critical RCE vulnerability in an open-source RDP client that FreeRDP has a documented track record of severe memory corruption and RCE flaws in, indicating avoidable negligence in its security posture.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberos_DecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP peer to trigger out-of-bounds reads and in-place writes during CredSSP/NLA Kerberos decryption. This issue is fixed in version 3.30.0.